Authentik provider + groups one-time setup for OIDC login and client enrollment #17

New Issue

2026-07-19T22:16:32-06:00

jhodgkin commented

2026-07-19 22:16:32 -06:00

Code for OIDC login and the client portal is deployed and tested (#10, #12), but Authentik needs one-time admin setup (see header comment in api/auth.js):

OAuth2/OpenID provider (confidential; redirect URIs for both dev and prod /api/auth/callback), application "LisiLou Portfolio"
lisilou-admin group with Elysse (grants dashboard access)
Enrollment flow for client self-registration (#12) — Authentik-side config only
Fill OIDC_* + SESSION_SECRET in both instances' api/.env

Update: commit c367758 ("Add idempotent Authentik setup script for issues #10/#12") automates steps 1–3 via the Authentik API — run it with AUTHENTIK_URL + AUTHENTIK_TOKEN once CT121 is confirmed reachable, then paste its printed output into step 4.

Migrated from docs/BACKLOG-2026-07-16.md (B3).

Code for OIDC login and the client portal is deployed and tested (#10, #12), but Authentik needs one-time admin setup (see header comment in `api/auth.js`): 1. OAuth2/OpenID provider (confidential; redirect URIs for both dev and prod `/api/auth/callback`), application "LisiLou Portfolio" 2. `lisilou-admin` group with Elysse (grants dashboard access) 3. Enrollment flow for client self-registration (#12) — Authentik-side config only 4. Fill `OIDC_*` + `SESSION_SECRET` in both instances' `api/.env` **Update:** commit `c367758` ("Add idempotent Authentik setup script for issues #10/#12") automates steps 1–3 via the Authentik API — run it with `AUTHENTIK_URL` + `AUTHENTIK_TOKEN` once CT121 is confirmed reachable, then paste its printed output into step 4. Migrated from `docs/BACKLOG-2026-07-16.md` (B3).

jhodgkin commented

2026-07-20 00:32:40 -06:00

Completed 2026-07-20 - see the comment on #12 for the full writeup (three bugs found and fixed in scripts/authentik-setup.sh, verified end-to-end on both dev and prod).

Design note on dev-vs-prod: this uses a single shared OAuth2 provider/application with both redirect URIs registered (dev-lisilou.jerodrigged.com and lisilou.jerodrigged.com), rather than two separate providers - same photographer, same lisilou-admin group, just two valid callback URLs. api/.env on each host has its own OIDC_REDIRECT_URI and its own SESSION_SECRET, sharing the same OIDC_CLIENT_ID/OIDC_CLIENT_SECRET/OIDC_ISSUER. Verified working independently on both hosts via a disposable test admin account driven through the real authorization-code+PKCE flow.

Completed 2026-07-20 - see the comment on #12 for the full writeup (three bugs found and fixed in `scripts/authentik-setup.sh`, verified end-to-end on both dev and prod). Design note on dev-vs-prod: this uses a **single shared** OAuth2 provider/application with both redirect URIs registered (`dev-lisilou.jerodrigged.com` and `lisilou.jerodrigged.com`), rather than two separate providers - same photographer, same `lisilou-admin` group, just two valid callback URLs. `api/.env` on each host has its own `OIDC_REDIRECT_URI` and its own `SESSION_SECRET`, sharing the same `OIDC_CLIENT_ID`/`OIDC_CLIENT_SECRET`/`OIDC_ISSUER`. Verified working independently on both hosts via a disposable test admin account driven through the real authorization-code+PKCE flow.

jhodgkin closed this issue

2026-07-20 00:32:41 -06:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: jhodgkin/lisilou-portfolio#17